---
page_title: "cloudflare_authenticated_origin_pulls Resource - Cloudflare"
subcategory: ""
description: |-
  Provides a Cloudflare Authenticated Origin Pulls resource. A cloudflare_authenticated_origin_pulls
  resource is required to use Per-Zone or Per-Hostname Authenticated
  Origin Pulls.
---

# cloudflare_authenticated_origin_pulls (Resource)

Provides a Cloudflare Authenticated Origin Pulls resource. A `cloudflare_authenticated_origin_pulls`
resource is required to use Per-Zone or Per-Hostname Authenticated
Origin Pulls.

## Example Usage

```terraform
# Authenticated Origin Pulls
resource "cloudflare_authenticated_origin_pulls" "my_aop" {
  zone_id = "0da42c8d2132a9ddaf714f9e7c920711"
  enabled = true
}

# Per-Zone Authenticated Origin Pulls
resource "cloudflare_authenticated_origin_pulls_certificate" "my_per_zone_aop_cert" {
  zone_id     = "0da42c8d2132a9ddaf714f9e7c920711"
  certificate = "-----INSERT CERTIFICATE-----"
  private_key = "-----INSERT PRIVATE KEY-----"
  type        = "per-zone"
}

resource "cloudflare_authenticated_origin_pulls" "my_per_zone_aop" {
  zone_id                                = "0da42c8d2132a9ddaf714f9e7c920711"
  authenticated_origin_pulls_certificate = cloudflare_authenticated_origin_pulls_certificate.my_per_zone_aop_cert.id
  enabled                                = true
}

# Per-Hostname Authenticated Origin Pulls
resource "cloudflare_authenticated_origin_pulls_certificate" "my_per_hostname_aop_cert" {
  zone_id     = "0da42c8d2132a9ddaf714f9e7c920711"
  certificate = "-----INSERT CERTIFICATE-----"
  private_key = "-----INSERT PRIVATE KEY-----"
  type        = "per-hostname"
}

resource "cloudflare_authenticated_origin_pulls" "my_per_hostname_aop" {
  zone_id                                = "0da42c8d2132a9ddaf714f9e7c920711"
  authenticated_origin_pulls_certificate = cloudflare_authenticated_origin_pulls_certificate.my_per_hostname_aop_cert.id
  hostname                               = "aop.example.com"
  enabled                                = true
}
```
<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `enabled` (Boolean) Whether to enable Authenticated Origin Pulls on the given zone or hostname.
- `zone_id` (String) The zone identifier to target for the resource. **Modifying this attribute will force creation of a new resource.**

### Optional

- `authenticated_origin_pulls_certificate` (String) The ID of an uploaded Authenticated Origin Pulls certificate. If no hostname is provided, this certificate will be used zone wide as Per-Zone Authenticated Origin Pulls.
- `hostname` (String) Specify a hostname to enable Per-Hostname Authenticated Origin Pulls on, using the provided certificate.

### Read-Only

- `id` (String) The ID of this resource.

## Import

Import is supported using the following syntax:

```shell
# global
$ terraform import cloudflare_authenticated_origin_pulls.example <zone_id>

# per zone
$ terraform import cloudflare_authenticated_origin_pulls.example <zone_id>/<certificate_id>

# per hostname
$ terraform import cloudflare_authenticated_origin_pulls.example <zone_id>/<certificate_id>/<hostname>
```
